Summary
Jason A. Donenfeld discovered that Software Properties incorrectly filtered
certain escape sequences when displaying PPA descriptions. If a user were
tricked into adding an arbitrary PPA, a remote attacker could possibly
manipulate the screen.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | software-properties | 0.96.20.10 |
| Ubuntu · 18.04 LTS 18.04:LTS | software-properties | 0.96.24.32.14 |
| Ubuntu · 20.04 LTS 20.04:LTS | software-properties | 0.98.9.2 |
Vulnerabilities 1
-
Unscored —
add-apt-repository print ASNI terminal codes
Versions of add-apt-repository before 0.98.9.2, 0.96.24.32.14, 0.96.20.10, and 0.92.37.8ubuntu0.1~esm1, printed a PPA (personal package archive) description to the terminal as-is, which allowed PPA owners to provide ANSI terminal escapes to modify terminal co…
References
-
report
https://ubuntu.com/security/CVE-2020-15709